@allbluecn/admin-app 0.1.0

package/src/lib/auth.config.ts

@@ -0,0 +1,264 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import type { StartAuthJSConfig } from 'start-authjs'
+import type { SessionUser } from '@/lib/session'
+import CredentialsProvider from '@auth/core/providers/credentials'
+import type { PrismaClient } from '@allbluecn/database'
+import bcrypt from 'bcryptjs'
+import { getRandomConfig, presetBgColors } from '@/components/settings/avatar/avatar-config'
+import { resolveIpLocation, getClientIp } from '@allbluecn/kernel'
+
+let _prisma: PrismaClient | null = null
+async function getDb(): Promise<PrismaClient> {
+  if (!_prisma) {
+    const mod = await import('@allbluecn/database')
+    _prisma = mod.prisma
+  }
+  return _prisma
+}
+
+function pickBgColor(seed: string) {
+  let hash = 0
+  for (let i = 0; i < seed.length; i++) hash = seed.charCodeAt(i) + ((hash << 5) - hash)
+  return presetBgColors[Math.abs(hash) % presetBgColors.length]
+}
+
+export const authConfig: StartAuthJSConfig = {
+  session: { strategy: 'jwt', maxAge: 30 * 24 * 60 * 60 },
+  pages: { signIn: '/login', error: '/login' },
+  secret: process.env.AUTH_SECRET,
+  trustHost: true,
+  cookies: {
+    sessionToken: {
+      name: 'auth.session-token',
+      options: {
+        httpOnly: true,
+        sameSite: 'lax',
+        path: '/',
+        secure: process.env.NODE_ENV === 'production',
+        domain: process.env.COOKIE_DOMAIN || undefined,
+      },
+    },
+  },
+  providers: [
+    CredentialsProvider({
+      name: 'credentials',
+      credentials: {
+        email: { label: 'Email', type: 'email' },
+        password: { label: 'Password', type: 'password' },
+      },
+      async authorize(credentials, request) {
+        const creds = credentials as { email: string; password: string; remember?: string; stayLoggedIn?: string }
+        if (!creds.email || !creds.password) return null
+
+        const user = await getDb().then(db => db.user.findUnique({
+          where: { email: creds.email },
+          select: { id: true, email: true, username: true, password: true, role: true, status: true },
+        }))
+
+        // 用户不存在：userId 为外键，无法记录日志（保持现状）
+        if (!user) return null
+
+        // 安全提取 IP/UA（start-authjs 传递的 request 类型可能不标准，失败不阻塞登录）
+        let ip: string | null = null
+        let userAgent: string | null = null
+        try {
+          const headers = request?.headers as { get?: (name: string) => string | null } | undefined
+          if (headers && typeof headers.get === 'function') {
+            ip = getClientIp(request as Request)
+            userAgent = headers.get('user-agent') || null
+          }
+        } catch {
+          // 忽略：IP/UA 仅用于日志，获取失败不影响登录
+        }
+
+        // 安全记录登录日志（DB 异常不阻塞登录流程）
+        const recordLog = async (success: boolean, message?: string, location?: string) => {
+          try {
+            await getDb().then(db => db.loginLog.create({
+              data: {
+                userId: user.id,
+                ip,
+                userAgent,
+                location: location ?? null,
+                success,
+                ...(message ? { message } : {}),
+              },
+            }))
+          } catch (err) {
+            console.error('[auth] 记录登录日志失败:', err)
+          }
+        }
+
+        // 账号状态异常：记录失败原因
+        if (user.status === 'BANNED') {
+          await recordLog(false, '账号已封禁')
+          return null
+        }
+        if (user.status === 'INACTIVE') {
+          await recordLog(false, '账号未激活')
+          return null
+        }
+        if (user.status !== 'ACTIVE') {
+          await recordLog(false, '账号状态异常')
+          return null
+        }
+
+        // 非管理员：admin 端专用拦截
+        if (!['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+          await recordLog(false, '非管理员账号')
+          return null
+        }
+
+        // 密码校验
+        const isValid = await bcrypt.compare(creds.password, user.password)
+        if (!isValid) {
+          await recordLog(false, '密码错误')
+          return null
+        }
+
+        // 登录成功：记录 IP/UA/地理位置
+        const location = await resolveIpLocation(ip)
+        await recordLog(true, undefined, location)
+        await getDb().then(db => db.user.update({ where: { id: user.id }, data: { lastLoginAt: new Date() } }))
+
+        const remember = creds.remember === 'true'
+        const stayLoggedIn = creds.stayLoggedIn === 'true'
+        return {
+          id: user.id,
+          email: user.email,
+          name: user.username,
+          role: user.role,
+          remember,
+          stayLoggedIn,
+        }
+      },
+    }),
+  ],
+  callbacks: {
+    async jwt({ token, user, trigger }) {
+      // DB 查询失败（Prisma Client 未 generate / 字段缺失 / 连接异常）不应炸 jwt 流程
+      try {
+      if (user) {
+        token.role = (user as { role: string }).role
+        token.id = user.id
+        const dbUser = await getDb().then(db => db.user.findUnique({
+          where: { id: user.id },
+          select: { avatarConfig: true, bgShape: true, bgColor: true, username: true },
+        }))
+        if (dbUser) {
+          if (dbUser.avatarConfig) {
+            token.avatarConfig = dbUser.avatarConfig as Record<string, number>
+            token.bgShape = dbUser.bgShape ?? 'square'
+            token.bgColor = dbUser.bgColor ?? '#fff'
+          } else {
+            const avatarConfig = getRandomConfig()
+            const bgColor = pickBgColor(dbUser.username)
+            await getDb().then(db => db.user.update({
+              where: { id: user.id },
+              data: { avatarConfig, bgShape: 'square', bgColor },
+            }))
+            token.avatarConfig = avatarConfig as Record<string, number>
+            token.bgShape = 'square'
+            token.bgColor = bgColor
+          }
+        }
+        token.lastActivity = Date.now()
+        token.adminTimeout = (user as { stayLoggedIn?: boolean }).stayLoggedIn
+          ? 12 * 60 * 60 * 1000
+          : 30 * 60 * 1000
+      }
+      if (token.id && trigger === 'update') {
+        const dbUser = await getDb().then(db => db.user.findUnique({
+          where: { id: token.id as string },
+          select: { avatarConfig: true, bgShape: true, bgColor: true, username: true },
+        }))
+        if (dbUser) {
+          token.avatarConfig = (dbUser.avatarConfig ?? getRandomConfig()) as Record<string, number>
+          token.bgShape = dbUser.bgShape ?? 'square'
+          token.bgColor = dbUser.bgColor ?? pickBgColor(dbUser.username)
+        }
+      }
+      if (token.id && !user && trigger !== 'update') {
+        const dbUser = await getDb().then(db => db.user.findUnique({
+          where: { id: token.id as string },
+          select: { bgShape: true, bgColor: true, avatarConfig: true, username: true },
+        }))
+        if (dbUser) {
+          token.bgShape = dbUser.bgShape ?? 'square'
+          token.bgColor = dbUser.bgColor ?? pickBgColor(dbUser.username)
+          token.avatarConfig = (dbUser.avatarConfig ?? getRandomConfig()) as Record<string, number>
+        }
+      }
+      if (token.lastActivity && token.adminTimeout) {
+        token.lastActivity = Date.now()
+      }
+      return token
+      } catch (e) {
+        console.error('[auth][admin] jwt callback 查询失败，降级返回原 token:', e)
+        return token
+      }
+    },
+    async session({ session, token }) {
+      if (session.user) {
+        if (token.lastActivity && token.adminTimeout) {
+          const elapsed = Date.now() - (token.lastActivity as number)
+          if (elapsed > (token.adminTimeout as number)) {
+            return { ...session, user: null } as unknown as typeof session
+          }
+        }
+        // 用户存在性校验：token 指向的用户在 DB 不存在（DB 重置 / 用户被删 + 旧 JWT 残留）
+        // DB 查询失败时降级跳过（不返回 user:null 导致登出），避免 Prisma Client 问题连锁影响登录
+        if (token.id) {
+          try {
+            const exists = await getDb().then(db => db.user.findUnique({
+              where: { id: token.id as string },
+              select: { id: true },
+            }))
+            if (!exists) {
+              return { ...session, user: null } as unknown as typeof session
+            }
+          } catch (e) {
+            console.error('[auth][admin] session callback 用户存在性检查失败，跳过:', e)
+          }
+        }
+        const user = session.user as unknown as SessionUser
+        user.role = token.role as string
+        user.id = token.id as string
+        user.avatarConfig = token.avatarConfig as Record<string, number> | undefined
+        user.bgShape = token.bgShape as string | undefined
+        user.bgColor = token.bgColor as string | undefined
+        if (token.name) user.name = token.name as string | null
+        if (token.email) user.email = token.email as string | null
+         user.image = (token.picture as string | null) ?? null
+
+         try {
+           const sub = await getDb().then(db => db.subscription.findUnique({
+             where: { userId: token.id as string },
+             select: { status: true, plan: { select: { name: true } } },
+           }))
+           user.planLabel =
+             sub?.status === 'ACTIVE' && sub.plan.name === 'pro' ? 'pro' : 'free'
+         } catch {
+           user.planLabel = 'free'
+         }
+       }
+       return session
+    },
+  },
+}

package/src/lib/avatar.ts

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+const DICE_BEAR_BASE = "https://api.dicebear.com/7.x";
+
+const DICE_BEAR_STYLES = ["avataaars", "micah", "notionists", "lorelei", "adventurer"] as const;
+
+type DiceBearStyle = (typeof DICE_BEAR_STYLES)[number];
+
+export interface AvatarOptions {
+  style?: DiceBearStyle;
+  size?: number;
+  square?: boolean;
+}
+
+export function getBoringAvatarUrl(
+  seed: string,
+  options: AvatarOptions = {}
+): string {
+  const { style = "avataaars", size = 80 } = options;
+
+  return `${DICE_BEAR_BASE}/${style}/svg?seed=${encodeURIComponent(seed)}&size=${size}`;
+}
+
+export function getAvatarFallback(name: string): string {
+  return name.charAt(0).toUpperCase();
+}

package/src/lib/i18n/client.ts

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import i18next, { type i18n as I18nInstance } from 'i18next'
+import { initReactI18next } from 'react-i18next'
+import LanguageDetector from 'i18next-browser-languagedetector'
+import { resources, fallbackLng, defaultNs, supportedLngs } from './config'
+
+let clientI18n: I18nInstance | null = null
+
+export function getClientI18n(): I18nInstance {
+  if (!clientI18n) {
+    clientI18n = i18next.createInstance()
+    clientI18n
+      .use(initReactI18next)
+      .use(LanguageDetector)
+      .init({
+        fallbackLng,
+        defaultNS: defaultNs,
+        supportedLngs: [...supportedLngs],
+        resources,
+        interpolation: { escapeValue: false },
+        react: { useSuspense: false },
+        detection: {
+          order: ['querystring', 'cookie', 'localStorage', 'navigator'],
+          lookupQuerystring: 'lng',
+          lookupCookie: 'lng',
+          lookupLocalStorage: 'lng',
+          caches: ['cookie', 'localStorage'],
+        },
+      })
+  }
+  return clientI18n
+}

package/src/lib/i18n/config.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import zhCommon from './locales/zh/common.json'
+import enCommon from './locales/en/common.json'
+import zhUsers from './locales/zh/admin-users.json'
+import enUsers from './locales/en/admin-users.json'
+import zhAi from './locales/zh/admin-ai.json'
+import enAi from './locales/en/admin-ai.json'
+import zhBilling from './locales/zh/admin-billing.json'
+import enBilling from './locales/en/admin-billing.json'
+import zhEnterprise from './locales/zh/enterprise.json'
+import enEnterprise from './locales/en/enterprise.json'
+
+export const supportedLngs = ['zh', 'en'] as const
+export type AppLocale = (typeof supportedLngs)[number]
+export const fallbackLng: AppLocale = 'zh'
+export const defaultNs = 'common'
+
+export const resources = {
+  zh: {
+    common: zhCommon,
+    'admin-users': zhUsers,
+    'admin-ai': zhAi,
+    'admin-billing': zhBilling,
+    enterprise: zhEnterprise,
+  },
+  en: {
+    common: enCommon,
+    'admin-users': enUsers,
+    'admin-ai': enAi,
+    'admin-billing': enBilling,
+    enterprise: enEnterprise,
+  },
+} as const
+
+export const namespaces = Object.keys(resources.zh) as Array<keyof typeof resources.zh>
+export type NamespaceKey = (typeof namespaces)[number]
+
+export function isSupportedLocale(lng: string): lng is AppLocale {
+  return (supportedLngs as readonly string[]).includes(lng)
+}

package/src/lib/i18n/detect.ts

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { supportedLngs, fallbackLng, isSupportedLocale, type AppLocale } from './config'
+
+export function detectLocale(request: Request, userLocale: string | null): AppLocale {
+  const url = new URL(request.url)
+  const queryLng = url.searchParams.get('lng')
+  if (queryLng && isSupportedLocale(queryLng)) return queryLng
+
+  const cookieHeader = request.headers.get('cookie') ?? ''
+  const cookieLng = parseCookieValue(cookieHeader, 'lng')
+  if (cookieLng && isSupportedLocale(cookieLng)) return cookieLng
+
+  if (userLocale && isSupportedLocale(userLocale)) return userLocale
+
+  const acceptLang = request.headers.get('accept-language')
+  if (acceptLang) {
+    const detected = matchBestLanguage(acceptLang)
+    if (detected) return detected
+  }
+
+  return fallbackLng
+}
+
+function parseCookieValue(cookieHeader: string, key: string): string | null {
+  const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${key}=([^;]+)`))
+  return match ? match[1] : null
+}
+
+function matchBestLanguage(acceptLang: string): AppLocale | null {
+  const entries = acceptLang
+    .split(',')
+    .map((part) => {
+      const [lang, qPart] = part.trim().split(';q=')
+      return { lang: lang.trim(), q: qPart ? parseFloat(qPart) : 1 }
+    })
+    .sort((a, b) => b.q - a.q)
+
+  for (const entry of entries) {
+    const base = entry.lang.split('-')[0].toLowerCase()
+    if (isSupportedLocale(base)) return base as AppLocale
+  }
+  return null
+}

package/src/lib/i18n/locales/en/admin-ai.json

@@ -0,0 +1,128 @@
+{
+  "page": {
+    "title": "AI Providers",
+    "description": "Manage AI provider configurations, models, and limits",
+    "create": "Create Provider",
+    "edit": "Edit Provider"
+  },
+  "provider": {
+    "name": "Provider",
+    "kind": "Adapter Type",
+    "status": "Status",
+    "apiKey": "API Key",
+    "baseUrl": "Base URL",
+    "models": "Models",
+    "enabled": "Enabled",
+    "disabled": "Disabled",
+    "totalKeys": "Total Keys",
+    "monthlyUsage": "Monthly Usage",
+    "displayName": "Display Name",
+    "brandName": "Brand Name",
+    "description": "Description",
+    "category": "Category",
+    "defaultBaseUrl": "Default Base URL",
+    "keyUrl": "Key URL",
+    "docsUrl": "Docs URL",
+    "keyPlaceholder": "Key Placeholder",
+    "iconSlug": "Icon Slug",
+    "brandColor": "Brand Color",
+    "isLocal": "Local Provider",
+    "sortOrder": "Sort Order"
+  },
+  "action": {
+    "addProvider": "Add Provider",
+    "editProvider": "Edit Provider",
+    "testConnection": "Test Connection",
+    "manageModels": "Manage Models",
+    "toggleEnabled": "Toggle Enabled"
+  },
+  "model": {
+    "id": "Model ID",
+    "name": "Model Name",
+    "inputPrice": "Input Price",
+    "outputPrice": "Output Price",
+    "capabilities": "Capabilities",
+    "custom": "Custom",
+    "apiFetched": "API Fetched"
+  },
+  "form": {
+    "addProvider": "Add AI Provider",
+    "editProvider": "Edit AI Provider",
+    "basicInfo": "Basic Info",
+    "integrationConfig": "Integration Config",
+    "modelList": "Models",
+    "providerId": "Provider ID",
+    "providerIdDesc": "Business identifier, lowercase letters/numbers/dashes only, used for adapter routing.",
+    "providerIdEditNote": "Cannot be changed after creation",
+    "providerIdPlaceholder": "e.g. openai, deepseek",
+    "preview": "Preview",
+    "previewDesc": "Icon preview appears after filling in",
+    "displayName": "Display Name",
+    "displayNameDesc": "Chinese name shown on user-side card",
+    "brandName": "Brand Name",
+    "brandNameDesc": "English brand name (used for first-letter fallback)",
+    "description": "Description",
+    "descriptionDesc": "One-line provider description",
+    "category": "Category",
+    "adapterKind": "Adapter Type",
+    "adapterKindDesc": "Determines which SDK protocol to call",
+    "badge": "Badge Text",
+    "badgeDesc": "Label shown in top-right of card (e.g. 「Recommended」「Hot」「NEW」), leave empty to hide",
+    "badgePlaceholder": "e.g. Recommended",
+    "brandColor": "Brand Color",
+    "brandColorDesc": "Card accent color (hex)",
+    "iconSlug": "Icon Slug",
+    "iconSlugDesc": "Slug from @lobehub/icons (e.g. OpenAI, Anthropic), leave empty for first-letter fallback",
+    "iconSlugPlaceholder": "e.g. openai",
+    "defaultBaseUrl": "Default BaseURL",
+    "defaultBaseUrlDesc": "Used when user doesn't specify a custom endpoint",
+    "keyUrl": "API Key URL",
+    "docsUrl": "Docs URL",
+    "apikeyPlaceholder": "API Key Placeholder",
+    "localDeploy": "Local Deploy",
+    "localDeployDesc": "Check for local services like Ollama; API Key not required",
+    "platformEnabled": "Platform Enabled",
+    "platformEnabledDesc": "Disabled providers are hidden from unconfigured users; configured users keep access",
+    "sortOrder": "Sort Weight",
+    "sortOrderDesc": "Lower numbers appear first",
+    "modelListDesc": "Users select enabled models from this list (optional, can leave empty)",
+    "validation": {
+      "providerIdRequired": "Please fill in Provider ID",
+      "displayNameRequired": "Please fill in Display Name"
+    },
+    "toast": {
+      "created": "Provider created",
+      "updated": "Provider updated",
+      "saveFailed": "Save failed: {{error}}"
+    }
+  },
+  "table": {
+    "pageTitle": "AI Provider Management",
+    "pageDescription": "Manage {{count}} providers. Disabled providers are hidden from unconfigured users; configured users keep access. Unused providers can be hard-deleted.",
+    "addProvider": "Add Provider",
+    "columns": {
+      "provider": "Provider",
+      "adapterKind": "Model Adapter",
+      "category": "Category",
+      "badge": "Badge",
+      "modelCount": "Model Count",
+      "userConfigCount": "User Configs",
+      "platformEnabled": "Platform Enabled",
+      "actions": "Actions"
+    },
+    "enabledToggle": "Platform Enabled Toggle",
+    "edit": "Edit",
+    "delete": "Delete",
+    "deleteDisabled": "{{count}} users have configured this, cannot delete",
+    "deleteConfirm": {
+      "title": "Confirm delete provider 「{{name}}」?",
+      "description": "This action cannot be undone. The provider will be permanently removed. If you only want to temporarily disable, use the 「Disable」 function instead.",
+      "confirm": "Confirm Delete"
+    },
+    "toast": {
+      "updated": "Updated",
+      "deleted": "Provider deleted",
+      "deleteFailed": "Delete failed"
+    }
+  }
+}

package/src/lib/i18n/locales/en/admin-billing.json

@@ -0,0 +1,56 @@
+{
+  "page": {
+    "title": "Billing",
+    "description": "Manage subscriptions, invoices, and revenue",
+    "selectSubmenu": "Please select a submenu on the left"
+  },
+  "subscription": {
+    "plan": "Plan",
+    "status": "Status",
+    "startDate": "Start Date",
+    "endDate": "End Date",
+    "amount": "Amount",
+    "currency": "Currency",
+    "interval": "Interval",
+    "totalUsers": "Total Users",
+    "overdue": "Overdue",
+    "active": "Active",
+    "cancelled": "Cancelled",
+    "trialing": "Trialing",
+    "workspace": "Workspace",
+    "seats": "Seats",
+    "expires": "Expires",
+    "detail": "Details",
+    "action": "Actions",
+    "empty": "No subscriptions yet",
+    "notFound": "Subscription not found",
+    "count": "{{count}} subscriptions",
+    "detailTitle": "Subscription Detail",
+    "periodStart": "Period Start",
+    "periodEnd": "Period End",
+    "providerSubscription": "Provider Subscription",
+    "back": "Back to List",
+    "invoicesTitle": "Invoices",
+    "invoiceDate": "Date",
+    "invoiceAmount": "Amount",
+    "invoiceStatus": "Status"
+  },
+  "invoice": {
+    "number": "Invoice Number",
+    "date": "Invoice Date",
+    "dueDate": "Due Date",
+    "total": "Total",
+    "paid": "Paid",
+    "unpaid": "Unpaid",
+    "view": "View Invoice",
+    "usd": "$",
+    "cny": "¥"
+  },
+  "action": {
+    "upgrade": "Upgrade Plan",
+    "downgrade": "Downgrade Plan",
+    "cancel": "Cancel Subscription",
+    "retryPayment": "Retry Payment",
+    "exportData": "Export Data"
+  }
+}